“De Visu” experts have discussed changes in personal data sphere

It is commonly known that the human-rights Commissioner of the Verkhovna Rada of Ukraine has cared for personal data (PD) field from the beginning of this year. These issues used to be within the competence of the State Service on Personal Data Protection (SSPDP), which is subordinated to the Ministry of Justice.

“De Visu” Group experts have discussed and analyzed what changes took place in this field after reshuffle of the supervisory authority.

Thus, the authority reshuffle led to the occurrence of the new regulatory framework, viz. the Order № № 1/02 of 08.01.2014 from the Commissioner, who approved:

A typical procedure for personal data processing;

Procedure for the monitoring of compliance with the legislation on personal data protection by the Commissioner (hereinafter – the Procedure for the monitoring);

The message procedure of personal data processing for the Commissioner, the processing is the special risk for the rights and freedoms of the personal data subject. The message procedure of structural subdivision or responsible officer who organizes the work related to the personal data protection during their processing as well as disclosure of mentioned information (hereinafter – the message procedure).

All these documents developed in pursuance of the Law of Ukraine “On Personal Data Protection” № 2297-VI of 01.06.2010 – the main document in PD protection field.

The lecturer mentioned that the personal data-base (PDB) registration is canceled according to the new rules. Now the Commissioner should be informed of PD processing, and then providing that the “special” PD of individuals is being processed. The employer, who processes the special data of his employees according to the Law, is exempt from this requirement.

Besides, the basis for personal data processing is not only the consent of the personal data subject according to Art.11 of the Law “On Personal Data Protection”. Therefore, the employer doesn’t need to obtain an employee’s consent to his PD processing any more. It is carried out in accordance with the Law.

Also, the sanctions for violation of PD protection and the inspection procedure by the human-rights Commissioner have been considered.

The fact of failure to notify the individual of the personal data processing is not the basis for the imposition of the penalty.

Now, the punishment for the violation of PD protection should be only if it led to the illegal access or the violation of PD subject’s rights.

“De Visu” Group experts are ready to hold seminars on different taxation issues, accounting and law. Please contact us in Kyiv: 8 (044)279-40-00, 8 (044)279-00-00.